The cyber attack against TV stations and banks in South Korea on Wednesday this week seems increasingly likely to have been by a government-level hacker who may have inserted a virus into a central computer providing antivirus protection, says an American security company.

But researchers from Fortinet, which specialises in internet security and who are still investigating what happened in Korea, said they are still unsure quite how the hack was done – although they are increasingly confident that it was the work of a foreign government targeting banks and broadcasters, which were hit earlier this week.

As many as 30,000 PCs in Shinhan Bank, Jeju Bank, Nonghyup Bank, the Munhwa Broadcasting Corporation, YTN and the Korea Broadcasting System (KBS) had their hard drives wiped when a virus activated at 14.00 local time on Wednesday 20 March.

Guillaume Lovet, threat response manager for Fortinet in Paris, said: "In examining some of the code for the malware responsible for the attack, we've found that it refers to a RAT – a remote access tool. That's not a phrase a normal virus writer would use. That's more like a professional." He explained: "My feeling is that the author of this is not a typical virus writer. So it could be a government-led attack."

But, he added, "if it is, then it's the least sophisticated attack that we have seen in years." He pointed out that despite the attack, the TV stations had been able to continue broadcasting and the banks had only reported brief interruptions to some ATM services.

That would suggest that the attack was done principally for propaganda purposes – in which it seems to have succeeded. At first, government sources in South Korea had blamed Wednesday's events on a cyber-attack orchestrated by North Korea. On Thursday, it said it had traced the attack to an internet address in China – but then backtracked and said the infection had come from a system inside one of the companies.

"We are still not sure about the vector of infection – how the virus got onto the machines," said Lovet. "The antivirus servers should be hardened against this sort of attack." One possibility was that the infected PCs were already part of a "botnet" – PCs which are surreptitiously under the control of a hacker who rents them out without the user knowing – and that the virus writer hired or bought access to them. Such transactions are common in the underworld of cyberspace.

North Korea faces UN sanctions over its 12 February nuclear test, and has been making aggressive military overtures – and sending warnings to South Korea – apparently as part of attempts to test the resolve of the south's newly elected prime minister.

In response, it has accused South Korea of hacking attacks, while being blamed itself for trying to carry out similar attacks against the south.

But North Korea is also believed to have been ramping up its capabilities for cyber attacks. The anti-virus firm McAfee blamed an attack in 2011 on systems based in the north, which it said at the time could be a test of the south's resilience.